CVE-2025-59838

Katalog CVE

CVSS 5.4 · Medium EPSS 0,23%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada monkeytype. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0.

Rincian

Terbit di NVD

25 September 2025

Terakhir diubah

13 Oktober 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-j4xx-fww5-774w exploit · advisory vendor
• https://github.com/monkeytypegame/monkeytype/commit/f025b121cbe437e29de432b4aa72e0de22c755b7 patch
• https://github.com/monkeytypegame/monkeytype/commit/42f6a16c6255d66cbb2be279131454866d98f2c9
• https://github.com/monkeytypegame/monkeytype/releases/tag/v25.44.0